Re: IL and XSS vulnerabilities in multiple themes for WordPress

["MustLive" <mustlive () websecurity com ua>]

Hi David!

You need to look harder ;-). Looks like you checked these two themes on those sites, admins of which deleted this file. 
There are admins who can understand that scripts with phpinfo must not be at working sites (but it's rare cases, and 
larger part of the sites with affected themes for WP contain test.php).

Yes, I've check all these 15 themes (I've tested even more and wasted a lot of time on it, but found exactly at these 
15 themes). I've found them at live web sites in Internet, as I mentioned earlier.

Here are examples of the sites with test.php in Typebased and NewsPress themes:

http://thenetexperiment.com/wp-content/themes/typebased/includes/test.php

http://coporan.3x.ro/wp-content/themes/newspress/includes/test.php

For example, in April I was trying to find test.php in these 15 and other themes at WooThemes' demo site, but they 
haven't this file in any of their themes (among those tested by me). So as for their own sites, then they understand 
the risk, and when to sell holes for large price for their clients, then they already don't understand the risk and 
position it as a feature :-).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
  ----- Original Message ----- 
  From: David Sopas 
  To: MustLive 
  Cc: full-disclosure () lists grok org uk 
  Sent: Tuesday, June 07, 2011 12:43 AM
  Subject: Re: [Full-disclosure] IL and XSS vulnerabilities in multiple themes for WordPress


  Just checked on two of those themes you wrote (Typebased and NewsPress) and they don't have any test.php file.
  Did you check them all? 





  On 4 June 2011 17:17, MustLive <mustlive () websecurity com ua> wrote:

    Hello list!

    I want to warn you about Information Leakage and Cross-Site Scripting
    vulnerabilities in multiple themes for WordPress.

    -------------------------
    Affected products:
    -------------------------

    Vulnerable are the next themes by WooThemes: Live Wire (all three themes
    from Live Wire series), Gotham News, Typebased, Blogtheme, VibrantCMS, Fresh
    News, The Gazette Edition, NewsPress, The Station, The Original Premium
    News, Flash News, Busy Bee, Geometric. Other vulnerable themes for WP are
    possible.

    ----------
    Details:
    ----------

    In different themes there is test.php - script with phpinfo() - which leads
    to Information Leakage (disclosure of FPD and other important information
    about the server) and XSS (in PHP < 4.4.1, 4.4.3-4.4.6).

    Information Leakage (WASC-13):

    http://site/wp-content/themes/_theme's_name_/includes/test.php

    XSS (WASC-08):

    http://site/wp-content/themes/_theme's_name_/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E

    For Live Wire the script is placed at address
    http://site/wp-content/themes/livewire/includes/test.php, similarly for
    other themes.

    ------------
    Timeline:
    ------------

    2011.04.11 - announced at my site.
    2011.04.12 - informed developers.
    2011.06.04 - disclosed at my site.

    These vulnerabilities are still not fixed by developers. So users of these
    themes are need to fix the vulnerabilities manually (e.g. by deleting of
    this script).

    I mentioned about these vulnerabilities at my site
    (http://websecurity.com.ua/5071/).

    Best wishes & regards,
    MustLive
    Administrator of Websecurity web site
    http://websecurity.com.ua


    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/